can you help me with regex

[tulusoy]

Hi,
I have a search with regex

ERROR   * | rex ".*?(?(?:\w+\.)+\w*?Exception).*"    | stats sparkline  count by exception |sort count desc

should I change limits.conf or change regex ?
Can you help me.

Thank you

[chrisyounger · Accepted solution]

Try this:

ERROR * | rex "(?<exception>\S+Exception)" | stats sparkline count by exception |sort count desc

[tulusoy]

thank you vey much. It runs

[somesoni2]

What's the problem here?

[damann]

Could you provide a sample positive event ? Btw. your regex is broken...

[niketn]

@tulusoy while posting code use the code button ( 101010 ) on Splunk Answers so that special characters do not escape.

You can also use shortcut Ctrl+K after selecting the code.

Or else add four spaces before each line of code and ensure to hit enter twice before writing first line of code so that there is a line gap between text and code. (Usually preview mode on Splunk Answer shows you how your final post will appear after submit.)